pumpfun-claimyoutoken-sol-zr41n3r[.]pages[.]dev

The domain pumpfun-claimyoutoken-sol-zr41n3r.pages.dev is a phishing site engaged in brand impersonation, specifically targeting users of the cryptocurrency exchange OKX. It presents itself as a 'PUMP FUN | AIRDROP' page to deceive victims into believing they are interacting with a legitimate token distribution event, though no drainer kit was identified. As of the latest verification, pumpfun-claimyoutoken-sol-zr41n3r.pages.dev has been taken offline, but its prior activity poses an elevated risk for those who may have engaged with it.

Technical indicators confirm the domain's malicious nature: 1 of 95 VirusTotal security vendors flagged pumpfun-claimyoutoken-sol-zr41n3r.pages.dev as malicious, and it appears on 1 security blocklist (PhishDestroy). Registered through Cloudflare, Inc. on March 22, 2026, the domain resolves to the IP address 188.114.96.3, hosted by Cloudflare in Canada. The SSL certificate is issued by Google Trust Services (WE1), and the site employed technologies such as HSTS, Cloudflare, and HTTP/3. The page title observed was 'PUMP FUN | AIRDROP', and the domain is associated with cryptocurrency scams.

Victims who interacted with pumpfun-claimyoutoken-sol-zr41n3r.pages.dev should immediately revoke any token approvals granted to unknown contracts and transfer funds to a new wallet to prevent unauthorized access. If login credentials were entered, change passwords for all associated accounts, enable two-factor authentication (2FA), and monitor for suspicious transactions or account activity. Report the phishing domain to platforms like Google Safe Browsing, PhishTank, or the impersonated brand (OKX) to aid in takedown efforts and protect other users.